T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/inspect-rest-api.sh:43
- Finding
- Application Password Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/inspect-rest-api.sh`, lines 43–44 and 100–101 **Vulnerability Type**: Credential exposure through process arguments and shell history **Risk Level**: High ### Vulnerable Code ```bash --app-password) APP_PASSWORD="${2:-}" shift 2 ;; ``` The captured secret is subsequently placed in the `curl` argument vector: ```bash if [[ -n "$USER_NAME" ]]; then CURL_ARGS+=(--user "${USER_NAME}:${APP_PASSWORD}") fi ``` The documented usage also instructs users to provide the secret directly on the command line: ```bash inspect-rest-api.sh --site https://example.com --user admin --app-password "xxxx xxxx xxxx xxxx" ``` ### Technical Analysis The WordPress application password is accepted as a command-line parameter and then interpolated into the `curl --user` argument. This creates two separate exposure points: 1. The initial script command can be recorded in interactive shell history. 2. While the script and `curl` are running, the secret may be observable through process-inspection interfaces or system monitoring tools capable of reading command-line arguments. An application password is an authentication credential. Although it can be individually revoked and may have less operational scope than the primary account password, it authorizes REST API actions available to the associated WordPress user. Passing it through an argument vector is not necessary for the Skill’s route-inspection functionality. ### Attack Path 1. A user follows the documented authenticated usage and invokes the script with `--app-password`. 2. The command, including the plaintext application password, may be retained in shell history. 3. The script constructs a child-process argument containing `username:application-password`. 4. A local user, process monitor, audit collector, or compromised process with sufficient access reads the command history or process arguments. 5. The attacker submits requests to the target WordPre ...[truncated 721 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the `--app-password PASS` command-line interface. - Read the password interactively from a terminal without echoing it, for example with `read -r -s`, when interactive use is intended. - For automation, accept credentials through a protected file or file descriptor with restrictive permissions rather than an argument. - Do not merely replace command-line arguments with a broadly exposed environment variable, because process environments may also be readable under some operating conditions. - Avoid passing the secret to `curl` as a visible argument. Use a temporary `curl` configuration or netrc file created with mode `0600`, pass only its filename to `curl`, and remove it immediately after use. - Update `SKILL.md`, the script usage output, and all examples so they no longer encourage placing application passwords in shell commands. - Recommend creating a dedicated WordPress automation account with only the capabilities required by the intended operation, and use a separately revocable application password for that account. ]]>